New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 870104 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Aug 2
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: buffer_count_ == 0u in buffer_manager.cc

Project Member Reported by ClusterFuzz, Aug 2

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4567084223430656

Fuzzer: afl_gpu_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  buffer_count_ == 0u in buffer_manager.cc
  gpu::gles2::BufferManager::~BufferManager
  gpu::gles2::BufferManager::~BufferManager
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579277:579284

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4567084223430656

Additional requirements: Requires Gestures

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 2

Components: Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 2

Labels: Test-Predator-Auto-Owner
Owner: jiajia....@intel.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/bb1ff6ae23813a01f053dbc64ccf032b8a4c4025 (Implement bindImageTexture for webgl2-compute).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: kbr@chromium.org piman@chromium.org
Owner: ----
Status: Available (was: Assigned)
It's not possible that this regression is caused by my change. There are below reasons:
1. Currently, webgl2-compute context is only enabled for passthrough command decoder. The context creation will fail if it's a validating command decoder(See https://chromium-review.googlesource.com/c/chromium/src/+/1149711). All APIs of webgl2-compute are also only supported for passthrough cmd decoder. But the crash happens in validating command decoder. So it's not possible that my change caused this regression.
2. The crash is a buffer CHECK failure. My code has nothing to do with the buffer.
Cc: jiajia....@intel.com
Labels: Test-Predator-Wrong-CLs
Project Member

Comment 5 by ClusterFuzz, Aug 2

ClusterFuzz has detected this issue as fixed in range 580086:580090.

Detailed report: https://clusterfuzz.com/testcase?key=4567084223430656

Fuzzer: afl_gpu_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  buffer_count_ == 0u in buffer_manager.cc
  gpu::gles2::BufferManager::~BufferManager
  gpu::gles2::BufferManager::~BufferManager
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=579277:579284
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=580086:580090

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4567084223430656

Additional requirements: Requires Gestures

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 2

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 4567084223430656 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment